Self-checking control systems have long been known in which an event sensor produces a signal which is monitored and some characteristic is superimposed on the sensor signal such that the monitoring of the superimposed characteristic can detect whether or not the control system is functioning continuously. Thus failure of the event which is being monitored by the sensor or failure of the control circuit itself to maintain the superimposed characteristic both result in a response of the self-checking control system which can be investigated and interpreted as either a failure of the event itself or failure of the circuit system.
Typically, systems of the above-described type have been employed to monitor the burner flame in power plants, particularly large scale industrial installations, where a photoresponsive device is arranged to be energized by the radiant energy from the flame in the firebox. By interposing a mechanical shutter which "chops" the light or radiation energy passing from the flame to the photodetector a modulated signal is obtained whenever a flame is present. By making the system responsive to the modulated signal but capable of causing an alarm or actuating suitable controls upon the absence of modulation the system is capable of responding both to the loss of burner flame or the failure of any of the circuit elements or the mechanical light interrupting device.
Systems of this type can be utilized either for producing an alarm indication or for actuating controls. In the example given where a burner flame is being monitored the occurrence of flame failure results in a signal which both gives an alarm and actuates controls to shut down the fuel supply and otherwise secure the burner system from dangerous or explosive conditions.
To ensure that self-checking control systems are fail-safe the end point for the signal derived by the system is generally applied to energize a control relay during the presence of the modulated signal from the sensor. If the control relay is maintained energized by the receipt of the modulated signal but produces the alarm or the shutdown control functions by becoming deenergized upon failure to receive the modulated signal a further safeguard is achieved in that an ordinary power failure will also deenergize the relay and initiate shutdown.
A simple system used to detect the presence of a condition can fail (due to component failure) in either the direction of showing the presence or absence of the condition. One of these directions may be an unsafe failure mode. In a flame failure control, a failure that indicates a flame when there is no flame is an unsafe failure mode. A failure that indicates no flame even if there is a flame present is a safe failure mode. When a photocell is used to detect radiation from a flame, for instance, it causes passage of photoelectric current. However, a component short circuit can provide the same current flow and, therefore, an absence of flame would not be detected. The same principle is true when a photocell is used to detect the modulation in a flame since the flame sensor can become electrically noisy and simulate a flame. Mechanical self-checking systems are designed to check for component failures by using an electromechanical chopper which allows the sensor a first time interval to lock at a flame when it must show the presence of a flame and a second time interval to interrupt the view of the flame when the sensor must recognize an absence of flame. The self-checking system operates continuously to detect the flame/no flame conditions repetitively. The system is arranged so that it must switch repetitively between signal and no signal conditions in order to maintain the system in operation. Therefore, any failure to switch to the no signal condition or any failure to switch to the signal condition will cause the system to interrupt the power supply to the fuel valve. There are two problems inherent in such self-checking systems. One of these is the mechanical wear leading to limited life of the equipment caused by the shutter continuously operating. The second problem is particularly related to systems that operate from the modulation present in the flame because the operation of the shutter exposes the sensor to alternating conditions of looking at the flame and no flame including the condition of looking at hot refractory in the furnace either with or without a flame present and then having the field of view obstructed by the shutter. This causes a large amount of inherent noise in the system because of the optical changes and leads to oscillations in the amplifier commonly called ringing, which interferes with a proper determination of the signal/no signal condition.
A common system for detecting the presence of flame using the inherent modulation characteristic of the flame itself frequently operates in the region of 10 Hz and it is desired to show a flame failure in less than one second. Therefore, any shutter operation must be for much shorter than one second. It is very difficult to separate the effect of the chopper on the flame signal from the normal 10 Hz modulation characteristic. In other words, the chopping of the light beam used to detect the failure of any component creates signals too close to the characteristic of the flame being used to detect the presence of the flame. The present invention system described eliminates both of these problems because there is no chopper or mechanical line interruption which causes a mechanical wear problem and, since the light beam is not optically interrupted, there are no interfering signals caused by interrupting the light path while the sensor is viewing hot refractory.